Record the Notarius implementation plan and review
This commit is contained in:
@@ -1,40 +1,84 @@
|
||||
# Feature 0002A Remediation Review
|
||||
# Feature 0003 Remediation Review
|
||||
|
||||
Status: resolved
|
||||
Status: open
|
||||
|
||||
The field-specific Audita configuration implementation has the intended
|
||||
architecture and its complete integration suite passes.
|
||||
Reviewed implementation commits:
|
||||
|
||||
## Finding 2: Synchronize Amendment Progress Tracking
|
||||
- `287fc4a Install and configure Notarius`
|
||||
- `733a194 Add focused Notarius integration coverage`
|
||||
|
||||
The role's complete integration suite passes. The production architecture is
|
||||
substantially complete and follows the selected nine-operation flow, but the
|
||||
following issues should be corrected before Feature 0003 is marked done.
|
||||
|
||||
## Finding 1: Correct the Galaxy License Metadata
|
||||
|
||||
Severity: medium
|
||||
|
||||
`ansible-role-notarius/meta/main.yml` declares `license: BSD-3-Clause`, while
|
||||
the repository's retained `LICENSE` file is CC0 1.0 Universal. Package metadata
|
||||
must not misstate the terms under which the repository is distributed.
|
||||
|
||||
### Required Remediation
|
||||
|
||||
- Change the Galaxy license identifier to `CC0-1.0`, consistent with the
|
||||
repository license and the other standalone roles that use the same license.
|
||||
- Run metadata lint as part of the complete integration suite.
|
||||
|
||||
## Finding 2: Remove the Redundant Build Change Override
|
||||
|
||||
Severity: low
|
||||
|
||||
The configuration amendment was completed in `ansible-role-audita` commits
|
||||
`e61f02f` and `847c4c3`, while the implementation plan and workspace status
|
||||
still described it as awaiting execution.
|
||||
The `Build Notarius` task sets `changed_when: true`. The
|
||||
`ansible.builtin.command` module already reports a successful executed command
|
||||
as changed, and the task's `when` expression already determines exactly when a
|
||||
build occurs. The override adds no behavior and conflicts with the convention
|
||||
to trust module behavior and require a reason for every additional directive.
|
||||
|
||||
### Resolution
|
||||
### Required Remediation
|
||||
|
||||
- Recorded the completed amendment commits in the durable Feature 0002
|
||||
roadmap.
|
||||
- Marked Feature 0002 complete in workspace status.
|
||||
- Replaced the completed fixed-location implementation plan with a pending-plan
|
||||
notice for Feature 0003.
|
||||
- Preserved Feature 0003 as the next proposed unit of work and identified its
|
||||
configuration-interface revision as the next roadmap-review step.
|
||||
- Remove `changed_when: true` from the production build task.
|
||||
- Retain the existing rebuild expression unchanged:
|
||||
`notarius_checkout.changed or not notarius_binary.stat.exists`.
|
||||
- Run the complete integration suite to confirm that build runs still report
|
||||
changed and immediate repeats remain clean.
|
||||
|
||||
## Review Conclusion
|
||||
## Finding 3: Make the Dependency-Opt-Out Test Prove the Selected Go Binary
|
||||
|
||||
No code remediation was required. A proposed assertion that the configuration
|
||||
was a regular file was rejected because a successful
|
||||
`ansible.builtin.template` operation already establishes the specified file
|
||||
state. Adding another assertion would re-prove the module's documented
|
||||
postcondition and conflict with the workspace convention to trust Ansible's
|
||||
abstraction boundary.
|
||||
Severity: low
|
||||
|
||||
The review ran the complete `tests/integration` suite on Ubuntu 26.04 with
|
||||
Ansible Core 2.21.3 and ansible-lint 26.8.0. It passed default minimal
|
||||
rendering, representative nested rendering, explicit falsey values, native
|
||||
configuration validation, configuration-only convergence, both rebuild
|
||||
triggers, dependency opt-out, metadata repair, restored default state,
|
||||
repeated convergence, and platform rejection. `git diff --check` also passed.
|
||||
The integration suite sets `notarius_go_binary` to a symlink whose target is
|
||||
`/snap/bin/go`. The test succeeds with the current implementation, but it would
|
||||
also succeed if the build task ignored `notarius_go_binary` and hard-coded
|
||||
`/snap/bin/go`. It therefore does not establish the acceptance criterion that
|
||||
a caller-supplied Go executable is actually used.
|
||||
|
||||
### Required Remediation
|
||||
|
||||
- Replace the symlink with a small executable wrapper in the suite's private
|
||||
temporary directory.
|
||||
- Have the wrapper record its invocation and then delegate to `/snap/bin/go`.
|
||||
- Assert that the invocation record was written during the dependency-opt-out
|
||||
build, while retaining the existing clean-repeat assertion.
|
||||
- Keep the wrapper and its record in the existing private temporary directory;
|
||||
do not add production behavior.
|
||||
|
||||
## Review Evidence
|
||||
|
||||
The review ran from `ansible-role-notarius`:
|
||||
|
||||
```sh
|
||||
tests/integration
|
||||
git diff --check
|
||||
```
|
||||
|
||||
The complete suite passed with Ansible Core 2.21.3 and ansible-lint 26.8.0. It
|
||||
covered default convergence, the selected source commit, executable version,
|
||||
native configuration validation, clean repeats, missing-binary and checkout
|
||||
rebuilds, metadata repair without rebuilding, nullable field rendering,
|
||||
PromptKit source alternatives, intentional falsey values, caller-side
|
||||
pipeline-map composition, dependency opt-out, and platform rejection. The
|
||||
suite restored Notarius `v0.6.0` and the minimal `version: 4` configuration.
|
||||
|
||||
No additional production tasks, configuration probes, runtime validation,
|
||||
private state, or unrequested hardening were found.
|
||||
|
||||
Reference in New Issue
Block a user